[GHSA-6wpv-cj6x-v3jw] http vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

[tjuyuxinzhang]

Updates

• Affected products
• CWEs
• References
• Source code location

Comments
The current advisory is incomplete and partly inaccurate in three ways.

1. Affected range is too broad/inaccurate
   GitHub currently lists the affected versions as < 0.7.3, but RubySec’s published advisory and the Ruby Advisory DB both document two patched version lines:

   • >= 0.7.3
   • ~> 0.6.4

   This means versions in the 0.6.x line starting at 0.6.4 are already fixed and should not be included in the vulnerable range. The more accurate affected range is:

   • < 0.6.4
   • >= 0.7.0, < 0.7.3 :contentReference[oaicite:6]{index=6}

2. Patched versions are incomplete
   GitHub currently lists only 0.7.3 as patched, but RubySec also lists the patched maintenance line ~> 0.6.4. That backported fix should be included. :contentReference[oaicite:7]{index=7}

3. Title / weakness should reflect the actual root cause
   The issue is described by the upstream disclosure and RubySec as an HTTPS MitM vulnerability caused by failure to call OpenSSL::SSL::SSLSocket#post_connection_check for hostname verification. This is more precise than the current generic “Exposure of Sensitive Information to an Unauthorized Actor” wording. :contentReference[oaicite:8]{index=8}

Supporting references:

• Vendor disclosure: https://groups.google.com/g/httprb/c/jkb4oxwZjkU
• RubySec advisory: https://rubysec.com/advisories/CVE-2015-1828/
• Ruby Advisory DB entry: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml
• Ruby OpenSSL discussion of the underlying hostname verification pitfall: Hostname verification should be required by default when OpenSSL::SSL::VERIFY_PEER is configured ruby/openssl#8
• https://security.snyk.io/vuln/SNYK-RUBY-HTTP-20210

[shelbyc]

Hi @tjuyuxinzhang, this is an interesting situation. I see version 0.6.4 mentioned as fixed in https://rubysec.com/advisories/CVE-2015-1828/ and https://github.com/rubysec/ruby-advisory-db/blob/master/gems/http/CVE-2015-1828.yml, but 0.6.4 isn't mentioned at all in the original vendor disclosure (https://groups.google.com/g/httprb/c/jkb4oxwZjkU) or in ruby/openssl#8. How did you determine that 0.6.4 contains a patch?